7 ms·
“Clickless” iOS exploits infect Kaspersky iPhones with never-before-seen malware
- open-paren 3y agohttps://securelist.com/operation-triangulation/109842/ https://securelist.com/operation-triangulation/109842/
- gnicholas 3y agoWould this be prevented if an iPhone were in Lockdown Mode? [1] 1: https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650
- lcampbell 3y agoGiven the exploit vector looks like yet another iMessage attachment bug, > The target iOS device receives a message via the iMessage service, with an attachment containing an exploit. and that one of the effects of Lockdown Mode is > Messages - Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable. It might be prevented. Pretty sure disabling iMessage altogether sidesteps this class of bugs too. I've lost track of how many times iMessage has been the root cause of "unattended iOS RCE," at this point it's almost user negligence to have left on.
- gnicholas 3y agoI was surprised that the article didn't mention Lockdown Mode considering the likely overlap in features. It's even possible that Lockdown Mode was developed (at least in part) to defeat these types of exploits, given the timeline.
- hospitalJail 3y agoApple has chosen that it is more important to exploit in-group bias with bubble colors than phone security. I joke, but I can't tell you how annoying iMessage has been. Its so bad with non-iphones, we basically switch to email or teams when doing group communication.
- dontlaugh 3y agoGenerally everyone uses WhatsApp already anyway.
- miohtama 3y agoLikely another C-based media codec or other similar legacy file reader bug.
- metadat 3y agoIs there a way to disable only the iMessage attachments functionality? (as an alternative to going full lockdown)
- gnicholas 3y agoI don't think this is possible, but I too wish it were. I hate the fact that you can't copy a link from Messages without it opening a preview. That means if you've been forwarded a link with trackers, it's impossible to remove the tracking bits before opening. Not good!
- veave 3y agoWhen you long-press a link, there's a button at the top right corner that says "Hide preview". If you press it, previews will stop opening automatically everywhere.
- gnicholas 3y agoWow, amazing. I always thought that was just to hide this preview. Thanks a million, anonymous HN commenter!
- jmah 3y agoLockdown Mode was added in iOS 16. The article only mentions iOS 15.7, saying there is no information whether iOS 16 is vulnerable (with or without Lockdown Mode), unfortunately. It's curious they say iOS 16 was released "last month" when it was released last year.
- game_the0ry 3y agoNon-click exploits are freaky. I wish there was a way to detect if my device is compromised.
- hospitalJail 3y agoTreat all of your devices as compromised. Between the FBI breaking the terrorist's iphone, Pegasus, etc... It might be best to have a burner smart phone that you keep off 99.99% of the time and get your secrets off it only.
- boringuser2 3y agoOr, you could just not have an iphone.
- game_the0ry 3y agoLame comment, but for what its worth - I assume my iphone acts like a cia tacking device that sends all my info to nsa, so I never put anything on there that could get me in real trouble. But it would suck if I got a text from a russian organized hacking criminal org that got a hold or my banking credentials.
- boringuser2 3y ago[flagged]
- tremere 3y agoBecause Android is a far more secure platform and Google is a far more trustworthy custodian of your data? Or are you recommending that one opt out of a good portion of society by not using a smartphone? For most people that is not really a convenient option.
- EdwardDiego 3y agoHopefully the diversity in the Android ecosystem (seems like every Android phone vendor wants to run their own variants of various bits) makes it harder to exploit all Android devices with one exploit. Also has the downside of increasing the attack surface, but yeah. I feel like it's potatoes grown from "seed" potatoes vs. potatoes grown from actual seeds.
- samspenc 3y agoMy first question upon seeing the title was "What are Kaspersky iPhones?" Answered in the first paragraph: "Kaspersky has been hit by an advanced cyberattack that used clickless exploits to infect the iPhones of several dozen employees with malware ..." So this was iPhones belonging to Kaspersky employees - though sounds like the exploit could hit any iPhone.
- amuletgrey 3y agoLooks like kaspersky just tries to blame iphones.
- pseudo0 3y ago> the fact of infection was detected by Kaspersky Unified Monitoring and Analysis Platform (KUMA), a native SIEM solution for information and event management; the system detected an anomaly in our network coming from Apple devices. Interesting. This demonstrates the big downside of iOS's security model - it's basically impossible to run useful host-based IDS, which likely would have flagged this much more quickly.
- ikekkdcjkfke 3y agoWhat an absolute joke that you can upload files on demand to someones phone as long as you have a number or an email
- TazeTSchnitzel 3y agoWhat is email if not a way to send files to other people's computers? I don't understand your point.
- jdm2212 3y agoGmail is not my computer.
- TazeTSchnitzel 3y agoThe moment you load a message preview, it may as well be.
- jdm2212 3y agoThe message preview is a few kilobytes of text, which is very different from loading an arbitrary (and arbitrarily large) file onto my machine.
- ikekkdcjkfke 3y agoSame case with email too. I prefer to access email through a browser where you have a little more control over what gets loaded. Atleast then it's above a clickless.
- killingtime74 3y agoInteresting that people in sensitive positions would use foreign made smartphones. Surely they are Russian companies that manufacture at least low end Android phones?
- theaudacityofyw 3y agoAndroid would still be running Google so I guess it's a risk either way. At least Apple seem to be more secure by default without any user config. Looked this up and there is indeed a Russian company called Ayya, making smartphones with a switch to disable the microphone. It'll also be changing from Android to a domestically made OS, it seems. https://www.indiatimes.com/technology/news/russia-ayya-t1-smartphone-running-custom-aurora-os-563869.html https://www.indiatimes.com/technology/news/russia-ayya-t1-sm...
- malermeister 3y agoDoesn't need to be a Google version of Android. Since it's open source, there's plenty of non-Google forks, such as this one, focusing on privacy and security: https://grapheneos.org/ https://grapheneos.org/
- enkid 3y agoThis was delivered by a remote exploit, not a supply chain issue. How would buying a domestically produced phone prevent this?
- kop316 3y agoThere's an entire section in the article titled: "Russia accuses Apple of colluding with the NSA". I would assume if the FSB isn't just blowing smoke, then your question is answered.
- stonepresto 3y agoI assume the norm, or at least what they want to be the norm, is Huawei, Oppo, or Xiaomi. Regardless of what manufacturer or OS you use, it will not protect you from motivated nation states or companies like NSO. If you are truly concerned for your life, especially in authoritarian regimes, don't carry a phone.
- user6723 3y agoThis is why on our GrapheneOS devices we use a messenger that is written in Rust.